Type DPAPI Blob

From truxwiki.com

Revision as of 12:55, 16 March 2024 by Sam (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to navigation Jump to search

Details
Defined Constant	`Type_DPAPI_Blob`
File Type Value	597
Parent Type	None
Carve	Yes
Format Details	Yes
MIME Type	`application/octet-stream`
Filename Extension	`bin`

Microsoft's Data Protection Application Programming Interface (DPAPI) Blob

Description

DPAPI Encrypted Data

Truxton Exploiters

This file type is handled by the following ETLs:

Expand

Details

This is data encrypted via Microsoft's DPAPI functions. The CryptProtectData function produces this blob.

Retrieved from "https://truxwiki.com/index.php?title=Type_DPAPI_Blob&oldid=7656"